1. Sub-linear Size Pairing-Based Non-interactive Zero-Knowledge Arguments Jens Groth University College London TexPoint fonts used in EMF. Read the TexPoint manual before you delete this box.: A A AAAAA A A A A A A

2. Motivation VoterOfficial We can only accept correctly formatted votes Attaching encrypted vote to this e-mail

3. Non-interactive zero-knowledge proof VoterOfficial Ok, we will count your vote Attaching encrypted vote to this e-mail + NIZK proof that correct format Soundness: Vote is correct Zero-knowledge: Vote is secret

4. Applications of NIZK proofs Ring signatures Group signatures Anonymous credentials Verifiable encryption Voting...

5. Related work CRSSizeProver comp.Verifier comp. Kilian-PetrankO(Nk 2 ) group O(Nk 2 ) expoO(Nk 2 ) mults Trapdoor permutationsStat. SoundComp. ZK GOSO(1) groupO(N) groupO(N) expoO(N) pairings Subgroup decisionPerfect soundComp. ZK Abe-FehrO(1) groupO(N) groupO(N) expoO(N) pairings Dlog & knowledge of expo.Comp. soundPerfect ZK Interactive +O(√N) O(N) mults Fiat-ShamirDlog and random oracleComp. soundPerfect ZK This workO(N 3/4 ) group O(N 5/4 ) multsO(N) mults Generic groupComp. soundPerfect ZK

6. Our contribution Perfect completeness Perfect zero-knowledge Computational soundness –Generic group model Short and efficient to verify CRSSizeProver comp.Verifier comp. Binary circuit5N 3/4 group120N 3/4 group73N 5/4 mults27N mults Arithmetic circuit5N 3/4 group117N 3/4 group33N 5/4 expos27N mults

7. Common reference string Bilinear group Commitment key CRS for knowledge CRS for products CRS for permutations within commitments CRS for rotations between commitments

8. Commitment with knowledge Commitment Argument of knowledge Verify Only one group element to commit to n elements

9. Circuit... Non-interactive product argument

10. Product argument CRS for products Soundness

11. Conclusion NIZK argument of knowledge –perfect completeness –perfect zero-knowledge –computational soundness Short and efficient to verify CRSSizeProver comp.Verifier comp. Binary circuit5N 3/4 group120N 3/4 group73N 5/4 mults27N mults Arithmetic circuit5N 3/4 group117N 3/4 group33N 5/4 expos27N mults CRS O(N 3(1-ε) ) and Size O(N ε ) Untrusted setup: Short perfect Zaps Co-soundness: Standard q-assumption